Back to docs

Obfuscation Guide

Understand the different obfuscation levels and how VM protection works to secure your Luau scripts.

Obfuscation Levels

Choose the level of protection that matches your needs. Higher levels provide stronger protection but may increase script size slightly.

Basic

Lightweight protection for simple scripts. Quick obfuscation with basic string encoding.

  • Variable renaming
  • String literal encoding
  • Comment stripping
  • Whitespace removal

Normal

Balanced protection with good performance. Includes control flow obfuscation and MBA expressions.

  • All Basic features
  • Control flow obfuscation
  • MBA expression injection
  • Dead code injection
  • Array scrambling

Full

Complete VM obfuscation. Transforms bytecode into a custom register-based virtual machine.

  • All Normal features
  • Register VM transformation
  • Multi-layer string encoding
  • Opcode shuffling
  • Control flow flattening
  • Anti-debug injection

Maximum

Maximum protection with anti-tamper and nested VM layers. For high-value scripts.

  • All Full features
  • Nested VM layers
  • Anti-tamper hooks
  • Runtime integrity checks
  • Custom cipher wrapping
  • Polymorphic bootstrapper

How VM Obfuscation Works

VM obfuscation transforms your original Lua bytecode into a custom instruction set that runs on a virtual machine interpreter. The original bytecode is never exposed — only the VM interpreter and encrypted bytecode exist in the final script.

Simplified flow:

Original Script → Bytecode → VM Transformation → Encrypted VM Bytecode
                                 ↓
                    Custom VM Interpreter (in Lua)
                                 ↓
                    Executes original behavior securely

String Encoding

Our multi-layer string encoding protects string literals from being readable in the obfuscated output. Multiple encoding algorithms are applied in layers:

  • S-Box: Substitution-box transformation with random key generation
  • Helix: Multi-round spiral encoding for deep obfuscation
  • Cascade: Progressive encoding with feedback loops
  • Spiral: Nested encoding for maximum protection

Control Flow Protection

Control flow flattening transforms your script's loops and conditionals into a flat state machine. This makes it extremely difficult for reverse engineers to understand the program flow.

Combined with opaque predicates (MBA expressions that always evaluate to a known value but are hard to analyze statically), this creates a formidable barrier against both static and dynamic analysis.